{"record":{"id":"c957e991e0a7f7c6","repo":"apereo/cas","slug":"unable-to-authorize-given-token-for-account","errorCode":null,"errorMessage":"Unable to authorize given token [{}] for account [{}]","messagePattern":"Unable to authorize given token \\[(.+?)\\] for account \\[(.+?)\\]","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"support/cas-server-support-gauth-core/src/main/java/org/apereo/cas/gauth/web/flow/GoogleAuthenticatorSaveRegistrationAction.java","lineNumber":54,"sourceCode":"        final OneTimeTokenCredentialRepository repository,\n        final CasConfigurationProperties casProperties,\n        final OneTimeTokenCredentialValidator<GoogleAuthenticatorTokenCredential, GoogleAuthenticatorToken> validator,\n        final TenantExtractor tenantExtractor) {\n        super(repository, casProperties, tenantExtractor);\n        this.validator = validator;\n    }\n\n    @Override\n    protected boolean validate(final GoogleAuthenticatorAccount account, final RequestContext requestContext) {\n        return FunctionUtils.doAndHandle(_ -> {\n            val token = requestContext.getRequestParameters().getRequiredInteger(REQUEST_PARAMETER_TOKEN);\n            if (validator.isTokenAuthorizedFor(token, account)) {\n                LOGGER.debug(\"Successfully validated token [{}]\", token);\n                val googleAuthenticatorToken = new GoogleAuthenticatorToken(token, account.getUsername());\n                validator.getTokenRepository().store(googleAuthenticatorToken);\n                return true;\n            }\n            LOGGER.warn(\"Unable to authorize given token [{}] for account [{}]\", token, account);\n            return false;\n        }, e -> false)\n        .apply(account);\n    }\n\n    @Override\n    protected Event getErrorEvent(final RequestContext requestContext) {\n        val response = WebUtils.getHttpServletResponseFromExternalWebflowContext(requestContext);\n        response.setStatus(HttpStatus.UNAUTHORIZED.value());\n        return error();\n    }\n\n    @Override\n    protected GoogleAuthenticatorAccount buildOneTimeTokenAccount(final RequestContext requestContext) {\n        val acct = super.buildOneTimeTokenAccount(requestContext);\n        return GoogleAuthenticatorAccount.from(acct);\n    }\n}","sourceCodeStart":36,"sourceCodeEnd":72,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-gauth-core/src/main/java/org/apereo/cas/gauth/web/flow/GoogleAuthenticatorSaveRegistrationAction.java#L36-L72","documentation":"GoogleAuthenticatorSaveRegistrationAction.validate() checks the submitted token via validator.isTokenAuthorizedFor(token, account). If not authorized it logs this warning and returns false, so the registration save (new secret/token store entry) is refused.","triggerScenarios":"validate() invoked with a token that does not validate against the given account's secret — wrong code typed during registration, expired window, or token not for this account; the fallback function also yields false on exceptions.","commonSituations":"User enters a code from a different account's entry in their authenticator app; delay between QR scan and code entry exceeds the window; server clock drift; duplicated registration attempts consuming tokens.","solutions":["Have the user enter a new code generated immediately after scanning the QR code for this specific account","Verify the account object passed to validate() matches the QR code that was scanned (same username/secret)","Synchronize clocks and, if needed, widen the token validation window in cas.authn.mfa.gauth.* settings","Retry the registration flow to regenerate a fresh secret and QR code"],"exampleFix":null,"handlingStrategy":"retry","validationCode":"boolean codeLooksValid = code != null && code.matches(\"\\\\d{6}\");\n// confirm account/secret freshly provisioned before validate()","typeGuard":null,"tryCatchPattern":"boolean ok = action.validate(token, account);\nif (!ok) {\n    // retry registration with a newly generated secret/QR\n}","preventionTips":["Enter the first code right after scanning the QR","Match the app entry to the account being registered","Sync clocks; widen validation window if drift is common","Regenerate the secret when repeated validation fails"],"tags":["otp","mfa","registration","validation"],"backgroundTag":"authentication-required","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}